US11537717B2 - Information processing apparatus - Google Patents

Information processing apparatus Download PDF

Info

Publication number
US11537717B2
US11537717B2 US16/814,007 US202016814007A US11537717B2 US 11537717 B2 US11537717 B2 US 11537717B2 US 202016814007 A US202016814007 A US 202016814007A US 11537717 B2 US11537717 B2 US 11537717B2
Authority
US
United States
Prior art keywords
bit value
update
random number
unit
logical operation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US16/814,007
Other languages
English (en)
Other versions
US20210034749A1 (en
Inventor
Hironori YOHATA
Shigeto UMEYAMA
Naoto Mori
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Denso Ten Ltd
Original Assignee
Denso Ten Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Denso Ten Ltd filed Critical Denso Ten Ltd
Assigned to DENSO TEN LIMITED reassignment DENSO TEN LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: MORI, NAOTO, UMEYAMA, SHIGETO, YOHATA, HIRONORI
Publication of US20210034749A1 publication Critical patent/US20210034749A1/en
Application granted granted Critical
Publication of US11537717B2 publication Critical patent/US11537717B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0208—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterized by the configuration of the monitoring system
    • G05B23/0213—Modular or universal configuration of the monitoring system, e.g. monitoring system having modules that may be combined to build monitoring program; monitoring system that can be applied to legacy systems; adaptable monitoring system; using different communication protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/58—Random or pseudo-random number generators
    • G06F7/582—Pseudo-random number generators
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0426—Programming the control sequence
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/58—Random or pseudo-random number generators
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W2050/0062—Adapting control system settings
    • B60W2050/0075—Automatic parameter input, automatic initialising or calibrating means
    • B60W2050/0083—Setting, resetting, calibration
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/24—Pc safety
    • G05B2219/24065—Real time diagnostics
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/26—Pc applications
    • G05B2219/2637—Vehicle, car, auto, wheelchair
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present invention relates to an information processing apparatus that updates a program stored in a storage.
  • ECUs Electronic control units
  • the ECUs are information processing apparatuses that control various devices such as an engine, a power steering device, an airbag and a transmission.
  • the ECU is a microcomputer, and executes software stored in a nonvolatile storage.
  • the ECU communicates with an update control device to acquire software for update, and rewrites the software stored in the nonvolatile storage with the acquired software for update.
  • the update control device may be referred to as a reprogramming tool.
  • JP-A-2015-14910 discloses an information distribution system that updates software of an in-vehicle terminal mounted on a vehicle.
  • the in-vehicle terminal acquires encrypted software from a server, and decrypts the acquired software.
  • the in-vehicle terminal verifies validity of a software unique key used for decryption before decrypting the acquired software.
  • the ECU authenticates the update control device that supplies the software for update before updating the software stored in the storage. In order to prevent the software of the ECU from being updated illegally, security during authentication of the update control device is required to be further increased.
  • An object of the present disclosure relates to provide an information processing apparatus that improves security during software update.
  • an information processing apparatus mounted on a vehicle including: a vehicle control unit configured to execute a control program used to control the vehicle; a random number generation unit configured to generate a random number; and an authentication unit configured to authenticate an update control device that controls update of the control program by using the random number generated by the random number generation unit.
  • the random number generation unit includes a first extraction unit configured to extract a bit value having a predetermined length from a count value of a first clock signal, a target bit acquisition unit configured to acquire, in a case where at least one bit position in an entropy stored in a buffer is designated as an update position, a bit value at the update position that is designated as a target bit value, a calculation unit configured to perform logical operation on the bit value extracted by the first extraction unit and the target bit value acquired by the target bit acquisition unit, a replacement unit configured to replace the bit value at the update position with a result of the logical operation obtained by the calculation unit, a position designation unit configured to designate a new update position after the bit value at the update position is replaced with the result of the logical operation, and an output unit configured to generate the random number from the entropy stored in the buffer and output the random number to the authentication unit.
  • the calculation unit performs logical operation on the bit value at the designated bit position and the bit value extracted from the count value of the first clock signal.
  • the replacement unit replaces the bit value at the designated bit position with the result of the logical operation obtained by the calculation unit.
  • the position designation unit designates the new bit position.
  • all the bits included in the entropy may be updated, and randomness of the entropy is increased.
  • the entropy is determined based on the count value of the clock signal, the randomness of the entropy is increased. Therefore, according to [1], it may be difficult for a third party to estimate the random number generated from the entropy.
  • the update control device is authenticated based on the random number, security during software update may be improved.
  • the random number generation unit may further include a second extraction unit configured to extract a bit value having a predetermined length from a count value of a clock signal having a second frequency different from a first frequency of the first clock signal
  • the calculation unit may include an intermediate calculation unit configured to perform logical operation on the bit value extracted by the first extraction unit and the bit value extracted by the second extraction unit, and a final calculation unit configured to perform logical operation on the obtained target bit value and a result obtained by the intermediate calculation unit.
  • the replacement unit may replace the bit value at the update position with the calculation result obtained by the final calculation unit.
  • the randomness of the entropy may further be increased.
  • the random number generation unit may further include a third extraction unit configured to extract a bit value having a predetermined length from a count value of a clock signal having a third frequency different from the first frequency and the second frequency, and the intermediate calculation unit performs logical operation on the bit value extracted by the second extraction unit and the bit value extracted by the third extraction unit to generate an intermediate calculation value, and performs logical operation on the intermediate calculation value generated and the bit value extracted by the first extraction unit.
  • a third extraction unit configured to extract a bit value having a predetermined length from a count value of a clock signal having a third frequency different from the first frequency and the second frequency
  • the intermediate calculation unit performs logical operation on the bit value extracted by the second extraction unit and the bit value extracted by the third extraction unit to generate an intermediate calculation value, and performs logical operation on the intermediate calculation value generated and the bit value extracted by the first extraction unit.
  • the randomness of the entropy may further be increased.
  • the first frequency may be higher than the second frequency and lower than the third frequency.
  • the intermediate calculation unit first perform logical operation on the bit value extracted from the count value of the second clock signal and the bit value extracted from the count value of the third clock signal.
  • the frequency of the second clock signal is the lowest, and the frequency of the third clock signal is the highest.
  • the random number generation unit may further include a counter configured to continue counting the first clock signal in a background while the vehicle control unit or the update control unit is executing interrupt processing, and the target bit acquisition unit acquires the target bit after completion of the interrupt processing.
  • the counter continues counting the first clock signal in the background even when the interrupt processing occurs. Since a period from the occurrence of the interrupt processing to the end thereof is random, the randomness of the bit value extracted from the count value of the first clock signal is increased. The randomness of the entropy may further be increased.
  • a control method of an information processing apparatus that includes a storage storing a control program used to control a vehicle and that executes the control program, the control method including: extracting a bit value having a predetermined length from a count value of a clock signal; acquiring, in a case where at least one bit position in an entropy stored in a buffer is designated as an update position, a bit value at the designated update position as a target bit value; performing logical operation on the bit value extracted and the target bit value acquired; replacing the bit value at the update position with a result of the logical operation; designating a new update position after the bit value at the update position is replaced; generating a random number from the entropy stored in the buffer; and authenticating an update control device configured to control update of the control program by using the generated random number.
  • the method according to [6] is used with information processing apparatus according to [1].
  • an information processing apparatus that improves security during software update may be provided.
  • FIG. 1 is a functional block diagram showing a configuration of a software update system including an information processing apparatus according to an embodiment of the present invention
  • FIG. 2 is a functional block diagram showing a configuration of the information processing apparatus shown in FIG. 1 ;
  • FIG. 3 is a diagram showing a hardware configuration of the information processing apparatus shown in FIG. 1 ;
  • FIG. 4 is a functional block diagram showing a configuration of the random number generation unit shown in FIG. 2 ;
  • FIG. 5 is a diagram showing a configuration of the calculation unit shown in FIG. 4 .
  • FIG. 6 is a diagram showing an example of allocation of a storage area in the storage shown in FIG. 2 ;
  • FIG. 7 is a sequence diagram showing an operation of the software update system shown in FIG. 1 ;
  • FIG. 8 is a flowchart of entropy generation processing shown in FIG. 7 ;
  • FIG. 9 is a diagram showing an example of logical operation performed by the calculation unit shown in FIG. 4 ;
  • FIG. 1 is a functional block diagram showing a configuration of a software update system 100 including an information processing apparatus 2 according to an embodiment of the present invention.
  • the software update system 100 updates software executed by the information processing apparatus 2 with reference to FIG. 1 .
  • “software” and “program” are used interchangeably.
  • the information processing apparatus 2 is an electronic control unit (ECU) mounted on a vehicle 1 .
  • the information processing apparatus 2 controls the vehicle 1 .
  • the information processing apparatus 2 controls an engine 3 mounted on the vehicle 1 .
  • the information processing apparatus 2 may be referred to as “ECU 2 ”.
  • the vehicle 1 includes the ECU 2 and the engine 3 .
  • a configuration of the vehicle 1 other than the ECU 2 and the engine 3 is omitted.
  • the ECU 2 executes a control program for the engine 3 to control the engine 3 .
  • the ECU 2 communicates with an update control device 4 to update the control program for the engine 3 .
  • the ECU 2 transmits a random number 35 used for authentication of the update control device 4 to the update control device 4 .
  • the ECU 2 authenticates the update control device 4 using a authentication key 4 K received from the update control device 4 . Details of updating the control program will be described below.
  • the engine 3 is a power source of the vehicle 1 .
  • the engine 3 generates power and applies a rotational force obtained from the generated power to drive wheels of the vehicle 1 .
  • the update control device 4 communicates with the ECU 2 to update the control program for the engine 3 stored in the ECU 2 . Before starting update of the control program, the update control device 4 transmits the random number transmission request 45 to the ECU 2 . When receiving the random number 35 from the ECU 2 as a response to a random number transmission request, the update control device 4 generates the authentication key 4 K using the received random number 35 . When receiving the authentication based on the authentication key 4 K from the ECU 2 , the update control device 4 transmits a control program for update to the ECU 2 .
  • FIG. 2 is a functional block diagram showing a configuration of the ECU 2 shown in FIG. 1 .
  • the ECU 2 includes a vehicle control unit 21 , an update control unit 22 , a clock generation circuit 23 and a storage 24 with reference to FIG. 2 .
  • the vehicle control unit 21 executes a first program 41 stored in the storage 24 to control the engine 3 .
  • the first program 41 is the control program for the engine 3 .
  • the update control unit 22 executes a second program 42 stored in the storage 24 to update the first program 41 stored in the storage 24 .
  • a configuration of the update control unit 22 will be described below.
  • the clock generation circuit 23 generates clock signals 50 to 53 having different frequencies from each other.
  • the clock signal 50 is output to the vehicle control unit 21 and the update control unit 22 .
  • the vehicle control unit 21 and the update control unit 22 operate in synchronization with the clock signal 50 received from the clock generation circuit 23 .
  • the clock signals 51 to 53 are output to the update control unit 22 and used to generate an entropy 31 described below.
  • the frequency of the clock signal 51 is higher than frequencies of the clock signals 52 and 53 .
  • the frequency of the clock signal 53 is lower than frequencies of the clock signals 51 and 52 .
  • the storage 24 is nonvolatile, and is a flash memory in the present embodiment.
  • the storage 24 stores the first program 41 and the second program 42 .
  • a buffer 43 is set in the storage 24 .
  • the buffer 43 stores the entropy 31 used to generate the random number 35 .
  • FIG. 3 is a block diagram showing a hardware configuration of the ECU 2 shown in FIG. 1 .
  • the ECU 2 includes a central processing unit (CPU) 201 , a random access memory (RAM) 202 , a communication interface 203 , an output interface 204 , an input interface 205 , a bus 206 and the storage 24 with reference to FIG. 3 .
  • CPU central processing unit
  • RAM random access memory
  • FIG. 3 is a block diagram showing a hardware configuration of the ECU 2 shown in FIG. 1 .
  • the ECU 2 includes a central processing unit (CPU) 201 , a random access memory (RAM) 202 , a communication interface 203 , an output interface 204 , an input interface 205 , a bus 206 and the storage 24 with reference to FIG. 3 .
  • CPU central processing unit
  • RAM random access memory
  • the CPU 201 executes a program loaded from the storage 24 into the RAM 202 to control the ECU 2 .
  • the RAM 202 is a main memory of the ECU 2 .
  • the CPU 201 incorporates the clock generation circuit 23 shown in FIG. 2 .
  • the CPU 201 operates in synchronization with the clock signal 50 generated by the clock generation circuit 23 .
  • the CPU 201 executes the first program 41 loaded into the RAM 202 , the CPU 201 operates as the vehicle control unit 21 .
  • the CPU 201 executes the second program 42 loaded into the RAM 202 , the CPU 201 operates as the update control unit 22 .
  • the CPU 201 does not execute the first program 41 and the second program 42 in parallel.
  • the communication interface 203 communicates with the update control device 4 using a protocol such as a transmission control protocol (a TCP) and an internet protocol (an IP).
  • a protocol such as a transmission control protocol (a TCP) and an internet protocol (an IP).
  • a communication method between the ECU 2 and the update control device 4 is not particularly limited.
  • the output interface 204 outputs a control signal to the engine 3 by using a control area network (a CAN).
  • the input interface 205 receives a detection signal from a temperature sensor or the like attached to the engine 3 by using the CAN.
  • the bus 206 connects the CPU 201 , the RAM 202 , the communication interface 203 , the output interface 204 , the input interface 205 and the storage 24 .
  • the update control unit 22 includes an authentication unit 25 , a random number generation unit 26 and an authentication key generation unit 27 with reference to FIG. 2 .
  • the authentication unit 25 communicates with the update control device 4 shown in FIG. 1 to authenticate the update control device 4 . Specifically, when receiving the random number transmission request 45 from the update control device 4 , the authentication unit 25 transmits the random number 35 generated by the random number generation unit 26 to the update control device 4 . The authentication unit 25 receives the authentication key 4 K generated by the update control device 4 using the random number 35 from the update control device 4 . The authentication unit 25 confirms validity of the update control device 4 based on the received authentication key 4 K and an authentication key 2 K generated by the authentication key generation unit 27 . When the authentication unit 25 can confirm the validity of the update control device 4 , update of the first program 41 stored in the storage 24 is started.
  • the random number generation unit 26 updates the entropy 31 stored in the buffer 43 using the clock signals 51 to 53 received from the clock generation circuit 23 .
  • the random number generation unit 26 receives the transmission request of the random number 35 from the update control device 4 , the random number generation unit 26 generates the random number 35 using the updated entropy 31 .
  • a configuration of the random number generation unit 26 will be described below.
  • the authentication key generation unit 27 generates the authentication key 2 K using the random number 35 received from the random number generation unit 26 .
  • the authentication key generation unit 27 outputs the generated authentication key 2 K to the authentication unit 25 .
  • FIG. 4 is a functional block diagram showing a configuration of the random number generation unit 26 shown in FIG. 2 .
  • a counter 261 a first extraction unit 262 , a second extraction unit 263 , a third extraction unit 264 , a target bit acquisition unit 265 , a calculation unit 266 , a replacement unit 267 , a position designation unit 268 and an output unit 269 are included with reference to FIG. 4 .
  • the counter 261 receives the clock signals 51 to 53 from the clock generation circuit 23 , and counts the received clock signals 51 to 53 .
  • the counter 261 outputs a first count value 51 A obtained by counting the clock signal 51 to the first extraction unit 262 .
  • the counter 261 outputs a second count value 52 A obtained by counting the clock signal 52 to the second extraction unit 263 .
  • the counter 261 outputs a third count value 53 A obtained by counting the clock signal 53 to the third extraction unit 264 .
  • the first extraction unit 262 receives the first count value 51 A from the counter 261 and extracts a bit value of the least significant bit from the received first count value 51 A.
  • the first extraction unit 262 extracts the extracted bit value as a first extracted bit value 51 B to the calculation unit 266 .
  • the second extraction unit 263 receives the second count value 52 A from the counter 261 and extracts a bit value of the least significant bit from the received second count value 52 A.
  • the second extraction unit 263 extracts the extracted bit value as a second extracted bit value 52 B to the calculation unit 266 .
  • the third extraction unit 264 receives the third count value 53 A from the counter 261 and extracts a bit value of the least significant bit from the received third count value 53 A.
  • the third extraction unit 264 extracts the extracted bit value as a third extracted bit value 53 B to the calculation unit 266 .
  • the target bit acquisition unit 265 acquires a bit value at an update position 57 notified by the position designation unit 268 in the entropy 31 stored in the buffer 43 .
  • the target bit acquisition unit 265 outputs the acquired bit value as a target bit value 54 to the calculation unit 266 .
  • the calculation unit 266 receives the first extracted bit value 51 B from the first extraction unit 262 , receives the second extracted bit value 52 B from the second extraction unit 263 , and receives the third extracted bit value 53 B from the third extraction unit 264 .
  • the calculation unit 266 receives the target bit value 54 from the target bit acquisition unit 265 .
  • the calculation unit 266 performs logical operation using the received extracted bit values 51 B to 53 B and the received target bit value 54 , and generates an update bit value 55 as a result of the logical operation.
  • the calculation unit 266 outputs the update bit value 55 to the replacement unit 267 .
  • the replacement unit 267 replaces the bit value at the update position 57 designated by the position designation unit 268 in the entropy 31 stored in the buffer 43 with the update bit value 55 received from the calculation unit 266 .
  • the replacement unit 267 notifies the position designation unit 268 of a replacement end notification 56 for indicating that the replacement of the bit value at the update position 57 is completed.
  • the position designation unit 268 When receiving the replacement end notification from the replacement unit 267 , the position designation unit 268 changes the update position 57 .
  • the position designation unit 268 notifies the target bit acquisition unit 265 and the replacement unit 267 of the changed update position 57 .
  • the output unit 269 When receiving the random number transmission request 45 from the authentication unit 25 , the output unit 269 reads the entropy 31 from the buffer 43 , and converts the read entropy 31 into the random number 35 . The output unit 269 outputs the random number 35 converted from the entropy 31 to the authentication key generation unit 27 .
  • FIG. 5 is a functional block diagram showing a configuration of the calculation unit 266 shown in FIG. 4 .
  • the calculation unit 266 includes a first intermediate calculation unit 601 , a second intermediate calculation unit 602 and a final calculation unit 603 with reference to FIG. 5 .
  • the first intermediate calculation unit 601 performs logical operation on the first extracted bit value 51 B received from the first extraction unit 262 and the third extracted bit value 53 B received from the third extraction unit 264 .
  • a first intermediate bit value 61 is generated as a result of the logical operation by the first intermediate calculation unit 601 .
  • the second intermediate calculation unit 602 performs logical operation on the second extracted bit value 52 B received from the second extraction unit 263 and the first intermediate bit value 61 received from the first intermediate calculation unit 601 .
  • a second intermediate bit value 62 is generated as a result of the logical calculation by the second intermediate calculation unit 602 .
  • the final calculation unit 603 performs logical operation on the target bit value 54 received from the target bit acquisition unit 265 and the second intermediate bit value 62 received from the second intermediate calculation unit 602 .
  • the final calculation unit 603 generates the update bit value 55 as a result of the logical operation.
  • FIG. 6 is a diagram showing an example of allocation of a storage area 70 in the storage 24 shown in FIG. 2 .
  • the storage area 70 includes a code flash area 71 and a data flash area 72 with reference to FIG. 6 .
  • the code flash area 71 is an area that stores a program executed by the CPU 201 .
  • the first program 41 and the second program 42 are written in the code flash area 71 .
  • the code flash area 71 is divided into a normal use area 711 and an update use area 712 .
  • the normal use area 711 stores a program used to control the vehicle 1 . Since the first program 41 is a control program for the engine 3 , the first program 41 is written in the normal use area 711 . When the CPU 201 operates as the vehicle control unit 21 , the second program 42 written in the update use area 712 is not loaded into the RAM 202 .
  • the update use area 712 stores a program used to update the program written in the normal use area 711 . Since the second program 42 is used to update the first program 41 , the second program 42 is written in the update use area 712 .
  • the program written in the normal use area 711 is not loaded into the RAM 202 . This is because, when the first program 41 is loaded into the RAM 202 , the update control unit 22 cannot rewrite the first program 41 written in the storage area 70 .
  • a part of the update use area 712 is used as the buffer 43 .
  • the buffer 43 stores the entropy 31 .
  • FIG. 7 is a sequence diagram showing an operation of the software update system 100 shown in FIG. 1 .
  • the operation of the software update system 100 will be described with reference to FIG. 7 .
  • the vehicle control unit 21 operates in synchronization with the clock signal 50 , and the update control unit 22 is stopped. That is, the first program 41 is being executed, and the second program 42 is not loaded into the RAM 202 .
  • the update of the first program 41 is not started, and the clock signals 51 to 53 are not generated.
  • the update control device 4 When the first program 41 stored in the storage 24 is updated, a driver of the vehicle 1 moves the vehicle 1 to a store of the vehicle 1 . In the store, the update control device 4 starts communication with the ECU 2 in response to a manipulation by a worker. Specifically, the update control device 4 transmits an update mode transition request to the ECU 2 (step S 11 ).
  • the update mode transition request is a message for instructing the ECU 2 to activate the update control unit 22 .
  • the update mode transition response is a message for notifying that transition to an update mode is started.
  • the update control device 4 When receiving the update mode transition response from the ECU 2 , the update control device 4 stands by until a predetermined standby time has elapsed (step S 13 ).
  • a length of the standby time is, for example, 5 seconds.
  • the standby time is determined based on an update mode transition time required for the ECU 2 to stop the vehicle control unit 21 and activate the update control unit 22 . Specifically, the standby time may be longer than the update mode transition time.
  • the ECU 2 executes reset processing (step S 14 ). Specifically, in the ECU 2 , the vehicle control unit 21 is stopped, and the update control unit 22 is activated. That is, the second program 42 is loaded into the RAM 202 instead of the first program. The CPU 201 starts the second program 42 loaded into the RAM 202 . As the vehicle control unit 21 is stopped, the first program 41 is unloaded from the RAM 202 . As a result, the first program 41 written in the code flash area 71 can be updated.
  • the ECU 2 starts entropy generation processing (step S 15 ). As a result of step S 15 , bits of the entropy 31 stored in the buffer 43 are updated. The entropy generation processing (step S 15 ) continues until the ECU 2 receives the random number transmission request 45 from the update control device 4 .
  • the entropy generation processing (step S 15 ) will be described in detail below.
  • the update control device 4 transmits the random number transmission request 45 to the ECU 2 (step S 16 ).
  • the random number transmission request 45 is a message for requesting transmission of the random number 35 used for authentication of the update control device 4 .
  • the ECU 2 When receiving the random number transmission request 45 from the update control device 4 , the ECU 2 generates the random number 35 using the entropy 31 stored in the buffer 43 (step S 17 ). As long as the random number 35 is generated based on the entropy 31 , a algorithm for generating the random number 35 is not limited. The random number 35 may not be a true random number. That is, the random number 35 may be a pseudo random number. The ECU 2 transmits the generated random number 35 to the update control device 4 (step S 18 ).
  • the authentication key generation unit 27 In the ECU 2 , the authentication key generation unit 27 generates the authentication key 2 K using the random number 35 received from the random number generation unit 26 (step S 19 ). The authentication key generation unit 27 outputs the authentication key 2 K generated in step S 19 to the authentication unit 25 .
  • the update control device 4 When receiving the random number 35 from the ECU 2 , the update control device 4 generates the authentication key 4 K using the received random number 35 (step S 20 ). The update control device 4 transmits the authentication key 4 K generated in step S 19 to the ECU 2 (step S 21 ).
  • the algorithm for generating the authentication key is not particularly limited.
  • advanced encryption standard AES
  • An encryption key for generating the authentication key 4 K may be the same as or different from an encryption key for generating the authentication key 2 K.
  • the authentication unit 25 authenticates the update control device 4 based on the authentication key 4 K received from the update control device 4 and the authentication key 2 K received from the authentication key generation unit 27 (step S 22 ). Specifically, the authentication unit 25 compares the authentication key 4 K with the authentication key 2 K.
  • the authentication unit 25 determines that the validity of the update control device 4 serving as a transmission source of the authentication key 4 K cannot be confirmed.
  • the authentication unit 25 transmits an authentication result notification for notifying that the update control device 4 cannot be authenticated to the update control device 4 (step S 23 ).
  • the ECU 2 may refuse to receive data transmitted from the update control device 4 .
  • the ECU 2 may request retransmission of the authentication key 4 K.
  • the authentication unit 25 determines that the validity of the update control device 4 serving as the transmission source of the authentication key 4 K is confirmed.
  • the authentication unit 25 transmits an authentication result notification for notifying that the update control device 4 is authenticated to the update control device 4 (step S 23 ).
  • the update control device 4 starts transmission of the first program 41 for update.
  • the update control unit 22 updates the first program 41 stored in the normal use area 711 using the first program 41 for update received from the update control device 4 .
  • a method of rewriting the first program 41 stored in the normal use area 711 to the first program 41 for update is not particularly limited.
  • the update control device 4 may collectively transmit the first program 41 for update to the ECU 2 .
  • the ECU 2 may temporarily store the first program 41 for update in a reserved area of the storage area 70 , and rewrite the first program 41 stored in the normal use area 711 with the temporarily stored first program 41 for update.
  • the update control device 4 may divide the first program 41 for update into data of a predetermined size, and transmit the divided data to the ECU 2 together with a command for instructing writing of the divided data.
  • the update control unit 22 may erase the first program 41 written in the normal use area 711 before starting reception of the divided data.
  • the update control unit 22 writes the divided data received together with the command in the normal use area 711 according to the command received from the update control device 4 .
  • the random number generation unit 26 counts the clock signals 51 to 53 to generate count values 51 A to 53 A.
  • the random number generation unit 26 updates the bits of the entropy 31 stored in the buffer 43 one by one using the least significant bit value in the generated count values 51 A to 53 A. Thereby, the random number generation unit 26 can increase randomness of the entropy 31 . Since the random number 35 used to generate the authentication keys 2 K and 4 K is generated from the entropy 31 having increased randomness, it is difficult for a third party to estimate the random number 35 . As a result, the ECU 2 can further improve security during software update.
  • FIG. 8 is a flowchart of the entropy generation processing (step S 15 ) shown in FIG. 7 .
  • FIG. 9 is a diagram showing an example of a logical operation performed by the calculation unit 266 shown in FIG. 4 .
  • step S 14 the random number generation unit 26 starts processing shown in FIG. 8 .
  • the processing shown in FIG. 8 the clock signals 51 to 53 are not generated.
  • the position designation unit 268 designates the least significant bit of the entropy 31 stored in the buffer 43 as the update position 57 (step S 501 ).
  • a data length of the entropy 31 is 128 (bits).
  • the least significant bit of the entropy 31 is a right end of the entropy 31 in FIG. 9 .
  • the position designation unit 268 notifies the target bit acquisition unit 265 and the replacement unit 267 of the update position 57 designated in step S 501 .
  • the counter 261 starts counting the clock signals 51 to 53 used to generate the entropy 31 (step S 502 ). Specifically, the update control unit 22 instructs the clock generation circuit 23 to generate the clock signals 51 to 53 . The clock generation circuit 23 generates the clock signals 51 to 53 by dividing an output signal from an electronic oscillator (not shown).
  • the counter 261 receives the clock signals 51 to 53 from the clock generation circuit 23 , and counts the received clock signals 51 to 53 .
  • the first count value 51 A is generated by counting the clock signal 51 .
  • the second count value 52 A is generated by counting the clock signal 52 .
  • the third count value 53 A is generated by counting the clock signal 53 .
  • the random number generation unit 26 extracts a bit value of the least significant bit from the first count value 51 A and the third count value 53 A generated by the counter 261 (step S 503 ).
  • the first extraction unit 262 reads the first count value 51 A from the counter 261 .
  • the first extraction unit 262 extracts the first extracted bit value 51 B from the least significant bit of the read first count value 51 A.
  • the third extraction unit 264 extracts the third extracted bit value 53 B from the least significant bit of the third count value 53 A read from the counter 261 .
  • the least significant bits of the first count value 51 A and the second count value 52 A are surrounded by a thick frame.
  • the first intermediate calculation unit 601 performs logical operation on the first extracted bit value 51 B and the third extracted bit value 53 B acquired in step S 503 to generate the first intermediate bit value 61 (step S 504 ).
  • the first intermediate calculation unit 601 obtains an exclusive OR of the first extracted bit value 51 B and the third extracted bit value 53 B.
  • the first intermediate calculation unit 601 outputs the obtained exclusive OR as the first intermediate bit value 61 to the second intermediate calculation unit 602 .
  • the first intermediate bit value 61 is “1”.
  • the calculation unit 266 can increase the randomness of the entropy 31 by using the first extracted bit value 51 B derived from the clock signal 51 and the third extracted bit value 53 B derived from the clock signal 53 for a first logical operation. This will be described in detail below.
  • the frequency of the clock signal 51 is the highest among the frequencies of the clock signals 51 to 53 .
  • the first extracted bit value 51 B is extracted from the least significant bit of the first count value 51 A obtained by counting the clock signal 51 .
  • the frequency of the clock signal 53 is the lowest among the frequencies of the clock signals 51 to 53 .
  • the third extracted bit value 53 B is extracted from the least significant bit of the third count value 53 A obtained by counting the clock signal 53 .
  • the third extracted bit value 53 B is changed at least once.
  • the larger a difference between the frequency of the clock signal 51 and the frequency of the clock signal 53 the larger the number of times the third extracted bit value 53 B is changed.
  • randomness of the first intermediate bit value 61 is increased. Since bit values of the entropy 31 are updated based on the first intermediate bit value 61 having increased randomness, the randomness of the entropy 31 is further increased.
  • the first extracted bit value 51 B is a plurality of consecutive bits in the first count value 51 A and includes the least significant bit of the first count value 51 A.
  • the third extracted bit value 53 B is extracted from the third count value under a condition the same as that of the first extracted bit value 51 B. Since each of the first extracted bit value 51 B and the third extracted bit value 53 B has a plurality of bits, the number of combinations of the first extracted bit value 51 B and the third extracted bit value 53 B is increased. The number of times the first extracted bit value 51 B is changed is larger than those of bit values at other bit positions of the first count value 51 A. The same applies to the third extracted bit value 53 B. As a result, it is further difficult to estimate the combination of the first extracted bit value 51 B and the third extracted bit value 53 B. As a result, the randomness of the first intermediate bit value 61 is further increased.
  • the second extraction unit 263 acquires the second extracted bit value 52 B from the second count value 52 A (step S 505 ). Specifically, the second extraction unit 263 reads the second count value 52 A from the counter 261 and extracts the bit value of the least significant bit from the read second count value 52 A. The second extraction unit 263 acquires the extracted bit value as the second extracted bit value 52 B.
  • the second intermediate calculation unit 602 performs logical operation on the first intermediate bit value 61 generated in step S 504 and the second extracted bit value 52 B acquired in step S 505 to generate the second intermediate bit value 52 B (step SS 506 ).
  • the second intermediate calculation unit 602 obtains an exclusive OR of the second extracted bit value 52 B and the first intermediate bit value 61 .
  • the first intermediate calculation unit 601 outputs the obtained exclusive OR as the second intermediate bit value 62 to the final calculation unit 603 .
  • the second intermediate bit value 62 is “0”.
  • the second extraction unit 263 acquires the second extracted bit value 52 B at a second time different from a first time when the first extraction unit 262 and the third extraction unit 264 acquire the first extracted bit value 51 B and the third extracted bit value 53 B. Thereby, the randomness of the entropy 31 can be increased. This will be described in detail below.
  • the first time is before the calculation for obtaining the first intermediate bit value 61 .
  • the second time is after the calculation for obtaining the first intermediate bit value 61 .
  • the second count value 52 A continues to be increased. Since it is difficult for a third party to estimate the above period, it is also difficult for the third party to estimate a combination of the first intermediate bit value 61 and the second extracted bit value 52 B extracted from the second count value 52 A. As a result, randomness of the second intermediate bit value 62 is increased. Since the bit values of the entropy 31 are updated based on the second intermediate bit value 62 having increased randomness, the randomness of the entropy 31 is further increased.
  • the target bit acquisition unit 265 acquires the target bit value 54 from the entropy 31 stored in the buffer 43 (step S 507 ). Specifically, the target bit acquisition unit 265 reads the bit value at the update position 57 designated by the position designation unit 268 from the entropy 31 stored in the buffer 43 . The target bit acquisition unit 265 outputs the read bit value as the target bit value 54 to the final calculation unit 603 .
  • the update position 57 is the least significant bit of the entropy 31 stored in the buffer 43 .
  • the final calculation unit 603 performs logical operation on the second intermediate bit value 62 acquired in step S 506 and the target bit value 54 acquired in step S 507 to generate the update bit value 55 (step S 508 ).
  • the final calculation unit 603 obtains an exclusive OR of the target bit value 54 and the second intermediate bit value 62 .
  • the final calculation unit 603 outputs the obtained exclusive OR as the update bit value 55 to the replacement unit 267 .
  • the target bit value 54 is “1”
  • the second intermediate bit value 62 is “1”. Since the update bit value 55 is the exclusive OR of the target bit value 54 and the second intermediate bit value 62 , the update bit value 55 is “0”.
  • the replacement unit 267 replaces the bit value at the update position 57 designated by the position designation unit 268 in the entropy 31 stored in the buffer 43 with the update bit value 55 acquired in step S 508 (step SS 509 ).
  • the update position 57 is the least significant bit of the entropy 31 stored in the buffer 43 . Therefore, the replacement unit 267 replaces the bit value “1” of the least significant bit of the entropy 31 with the update bit value 55 . As a result, the bit value of the least significant bit of the entropy 31 is changed to “0”.
  • the position designation unit 268 changes the update position 57 (step S 510 ). Specifically, the position designation unit 268 designates a position of a bit that is higher than the bit at the current update position 57 in the entropy 31 stored in the buffer 43 and adjacent to the update position 57 as the new update position 57 . That is, the new update position 57 is one bit higher than the current update position 57 .
  • the current update position 57 is the least significant bit of the entropy 31 stored in the buffer 43 .
  • the position designation unit 268 designates the position of the bit located on the left of the least significant bit of the entropy 31 as the new update position 57 .
  • the bit at the new update position 57 is indicated by a broken line.
  • the random number generation unit 26 determines whether the authentication unit 25 receives the random number transmission request 45 from the update control device 4 (step S 511 ). When the authentication unit 25 does not receive the random number transmission request 45 from the update control device 4 (No in step S 511 ), the random number generation unit 26 executes steps S 503 to S 510 to update a bit value of the new update position 57 .
  • each bit of the entropy 31 is designated as the update position 57 .
  • a change in the update position 57 will be described with reference to FIG. 9 .
  • the position designation unit 268 designates the bit position one bit higher than the current update position as the new update position 57 .
  • the position designation unit 268 designates the least significant bit of the entropy 31 as the new update position, as indicated by an arrow 59 .
  • step S 511 The description returns to step S 511 .
  • the authentication unit 25 receives the random number transmission request 45 from the update control device 4 (Yes in step S 511 )
  • the counter 261 stops counting the clock signals 51 to 53 (step S 512 ).
  • the random number generation unit 26 ends the processing shown in FIG. 8 .
  • the random number generation unit 26 When interrupt processing occurs during the execution of the entropy generation processing (step S 15 ), the random number generation unit 26 continues counting the clock signals 51 to 53 . During the execution of the interrupt processing by the vehicle control unit 21 or the update control unit 22 , the random number generation unit 26 stops updating the bits of the entropy 31 stored in the buffer 43 . That is, when the interrupt processing occurs, the random number generation unit 26 sets priorities of processing of steps S 503 to S 510 shown in FIG. 8 to be lower than a priority of the interrupt processing. In this case, while the counting of the clock signals 51 to 53 is continued, the designation of the update position 57 in the entropy 31 and the replacement of the bit value at the update position 57 are stopped.
  • the random number generation unit 26 resumes the processing of steps S 503 to S 510 shown in FIG. 8 .
  • the counting of the clock signals 51 to 53 is continued even during the execution of the interrupt processing. A period from the occurrence of the interrupt processing to the end thereof is random. Therefore, randomness of the first extracted bit value 51 B, the second extracted bit value 52 B and the third extracted bit value 53 B obtained immediately after the end of the interrupt processing is increased. Accordingly, since the random number generation unit 26 can increase the randomness of the entropy 31 , it may be difficult for a third party to estimate the random number 35 .
  • the random number generation unit 26 may end the entropy generation processing (step S 15 ). In this case, the random number generation unit 26 generates the random number 35 based on the entropy 31 before the interruption processing occurs. Alternatively, when the interrupt processing is completed, the random number generation unit 26 may end the entropy generation processing (step S 15 ) after executing the processing of steps S 503 to S 510 shown in FIG. 8 once.
  • the frequency of the clock signal 51 is different from an integer multiple of the frequencies of the clock signals 52 and 53 .
  • the frequency of the clock signal 52 is different from an integer multiple of the frequency of the clock signal 53 .
  • the frequency of the clock signal 51 is different from an integer multiple of the frequency of the clock signal 53 .
  • the least common multiple of the frequency of the clock signal 51 and the frequency of the clock signal 53 can be increased.
  • the randomness of the combination of the first extracted bit value 51 B based on the clock signal 51 and the third extracted bit value 53 B based on the clock signal 53 is improved, the randomness of the first intermediate bit value 61 is improved.
  • the ECU 2 can improve the security when the first program 41 is updated.
  • the frequency of the clock signal 52 is different from an integer multiple of the frequency of the clock signal 51 , and is different from the integer multiple of the frequency of the clock signal 53 .
  • the first intermediate bit value is calculated from the first extracted bit value 51 B and the third extracted bit value 53 B.
  • the randomness of the second intermediate bit value 62 is improved as the randomness of the combination of the second extracted bit value 52 B and the first intermediate bit value 61 is improved. As a result, since the reproducibility of the entropy 31 is reduced, the ECU 2 can improve the security when the first program 41 is updated.
  • the position designation unit 268 designates the new update position 57 . Whenever the new update position 57 is designated, generation of the update bit value 55 is repeated. As a result, the bits of the entropy 31 stored in the buffer 43 are updated. Since the bit value updated in steps S 503 to S 511 shown in FIG. 8 is random as described below, the randomness of the entropy 31 can be improved.
  • the position designation unit 268 may designate a plurality of bit positions as the update position 57 in the entropy 31 stored in the buffer 43 .
  • the plurality of designated bit positions are consecutive.
  • the first extraction unit 262 extracts, from the first count value 51 A, the first extracted bit value 51 B from two consecutive bit positions including the least significant bit.
  • the second extraction unit 263 and the third extraction unit 264 designates the plurality of bit positions as the update position 57 .
  • the position designation unit 268 designates the plurality of bit positions as the update position 57 .
  • the number of combinations of the first extracted bit value 51 B and the third extracted bit value 53 B is increased.
  • the randomness of the entropy 31 since the randomness of the entropy 31 is increased, it may be more difficult to estimate the first intermediate bit value 61 .
  • the present invention is not limited thereto.
  • the first extraction unit 262 may extract a bit value from a bit position other than the least significant bit of the first count value 51 A. The same applies to the second extraction unit 263 and the third extraction unit 264 .
  • the calculation unit 266 first perform logical operation on the first extracted bit value 51 B and the third extracted bit value 53 B has been described in the above embodiment, the present invention is not limited thereto.
  • the combination of two bit values on which logical operation is performed is not particularly limited.
  • calculation unit 266 acquires an exclusive OR of two bit values
  • present invention is not limited thereto.
  • the calculation unit 266 may use logical disjunction (OR), logical conjunction (AND) or the like. That is, the calculation unit 266 may perform logical operation on the two bit values.
  • the calculation unit 266 may use a combination of a plurality of logical operations such as OR, AND and exclusive OR.
  • the random number generation unit 26 may start the entropy generation processing (step S 15 ) when the vehicle control unit 21 is operating. In this case, the random number generation unit 26 may end the entropy generation processing (step S 15 ) at any timing until the ECU 2 receives the random number transmission request 45 from the update control device 4 .
  • the random number generation unit 26 may be stored in the storage 24 as a program different from the second program 42 .
  • the present invention is not limited thereto.
  • the counter 261 may not count the clock signal 53 .
  • the calculation unit 266 performs logical operation on the first extracted bit value 51 B and the second extracted bit value 52 B to generate an intermediate bit value.
  • the calculation unit 266 outputs a result of the logical operation performed on the generated intermediate bit value and the target bit value 54 to the replacement unit 267 as the updated bit value 55 .
  • the counter 261 may count only the clock signal 51 .
  • the calculation unit 266 outputs a result of the logical operation on the first extracted bit value 51 B and the target bit value 54 to the replacement unit 267 as the update bit value 55 . Even in this case, since the bit values of the entropy 31 are updated, it may be difficult to estimate the random number generated from the entropy 31 .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Automation & Control Theory (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Computational Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Stored Programmes (AREA)
US16/814,007 2019-07-31 2020-03-10 Information processing apparatus Active 2041-03-19 US11537717B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
JP2019141154A JP7253470B2 (ja) 2019-07-31 2019-07-31 情報処理装置
JPJP2019-141154 2019-07-31
JP2019-141154 2019-07-31

Publications (2)

Publication Number Publication Date
US20210034749A1 US20210034749A1 (en) 2021-02-04
US11537717B2 true US11537717B2 (en) 2022-12-27

Family

ID=69804669

Family Applications (1)

Application Number Title Priority Date Filing Date
US16/814,007 Active 2041-03-19 US11537717B2 (en) 2019-07-31 2020-03-10 Information processing apparatus

Country Status (4)

Country Link
US (1) US11537717B2 (zh)
EP (1) EP3771978B1 (zh)
JP (1) JP7253470B2 (zh)
CN (1) CN112306037B (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230153094A1 (en) * 2021-11-18 2023-05-18 Toyota Motor North America, Inc. Robust over the air reprogramming

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117540669A (zh) * 2023-04-25 2024-02-09 北京芯思维科技有限公司 数字电路的结构化数据处理方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003104969A2 (en) 2002-06-06 2003-12-18 Cryptico A/S Method for improving unpredictability of output of pseudo-random number generators
US20150012750A1 (en) * 2013-07-05 2015-01-08 Clarion Co., Ltd. Information distribution system, and server, on-board terminal and communication terminal used therefor
US20190286421A1 (en) * 2016-11-29 2019-09-19 Continental Teves Ag & Co. Ohg Method for providing random numbers for control units of a vehicle network, and vehicle network for performing said method
US20200151077A1 (en) * 2018-11-14 2020-05-14 Arm Limited Apparatus and method of generating random numbers
US20220156057A1 (en) * 2019-03-18 2022-05-19 Autonetworks Technologies, Ltd. In-vehicle update device, update processing program, and program update method

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1114363B1 (en) * 1998-09-14 2005-11-16 Igt Random number generator seeding method and apparatus
GB2361567B (en) * 2000-04-18 2004-02-11 Mitel Corp Hardware authentication system and method
US6961852B2 (en) * 2003-06-19 2005-11-01 International Business Machines Corporation System and method for authenticating software using hidden intermediate keys
JP2005276113A (ja) 2004-03-26 2005-10-06 Denso Corp 擬似乱数生成方法、セキュリティチェック方法および制御装置
JP4734089B2 (ja) * 2005-10-27 2011-07-27 日立オートモティブシステムズ株式会社 車載端末
JP5119417B2 (ja) 2008-04-17 2013-01-16 ルネサスエレクトロニクス株式会社 擬似乱数生成装置
JP2016061915A (ja) * 2014-09-17 2016-04-25 株式会社リコー 情報処理装置、情報処理システム、情報処理方法及びプログラム
US9916151B2 (en) * 2015-08-25 2018-03-13 Ford Global Technologies, Llc Multiple-stage secure vehicle software updating
US10326589B2 (en) * 2015-09-28 2019-06-18 Mitsubishi Electric Corporation Message authenticator generating apparatus, message authenticator generating method, and computer readable recording medium
US11146401B2 (en) * 2016-08-10 2021-10-12 Ford Global Technologies, Llc Software authentication before software update
US11301347B2 (en) * 2016-10-31 2022-04-12 Harman Becker Automotive Systems Gmbh Software update mechanism for safety critical systems
US10705820B2 (en) * 2017-02-02 2020-07-07 Ford Global Technologies, Llc Method and apparatus for secure multi-cycle vehicle software updates
CN109656514B (zh) 2017-10-11 2023-08-15 华邦电子股份有限公司 随机数产生系统及其随机数产生方法
JP2020088458A (ja) 2018-11-16 2020-06-04 株式会社デンソーテン 情報処理装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003104969A2 (en) 2002-06-06 2003-12-18 Cryptico A/S Method for improving unpredictability of output of pseudo-random number generators
US20150012750A1 (en) * 2013-07-05 2015-01-08 Clarion Co., Ltd. Information distribution system, and server, on-board terminal and communication terminal used therefor
JP2015014910A (ja) 2013-07-05 2015-01-22 クラリオン株式会社 情報配信システムおよびそれに用いるサーバ、車載端末、通信端末
US20190286421A1 (en) * 2016-11-29 2019-09-19 Continental Teves Ag & Co. Ohg Method for providing random numbers for control units of a vehicle network, and vehicle network for performing said method
US20200151077A1 (en) * 2018-11-14 2020-05-14 Arm Limited Apparatus and method of generating random numbers
US20220156057A1 (en) * 2019-03-18 2022-05-19 Autonetworks Technologies, Ltd. In-vehicle update device, update processing program, and program update method

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230153094A1 (en) * 2021-11-18 2023-05-18 Toyota Motor North America, Inc. Robust over the air reprogramming

Also Published As

Publication number Publication date
CN112306037A (zh) 2021-02-02
EP3771978A1 (en) 2021-02-03
CN112306037B (zh) 2024-07-05
JP7253470B2 (ja) 2023-04-06
EP3771978B1 (en) 2023-09-06
US20210034749A1 (en) 2021-02-04
JP2021026290A (ja) 2021-02-22

Similar Documents

Publication Publication Date Title
US9602487B2 (en) Method for the protected transmission of data
CN108696476B (zh) 安全策略可配置的汽车车钥系统及其实现方法
US10423401B2 (en) Method for updating software of a control device of a vehicle
CN112019340B (zh) 认证系统
US11537717B2 (en) Information processing apparatus
US20190294826A1 (en) Information processing apparatus, information processing system, and information processing method
JP2009253783A (ja) 携帯端末、データ保護方法およびデータ保護用プログラム
US11228602B2 (en) In-vehicle network system
JP2018073245A (ja) 検査装置、検査システム、情報処理装置、検査方法およびコンピュータプログラム
JP6888122B2 (ja) 半導体装置、更新データ提供方法、更新データ受取方法およびプログラム
CN113162928B (zh) 通信方法、装置、ecu、车辆及存储介质
WO2019224912A1 (ja) 車両通信装置、車両アクセス制御システム、管理装置、車両アクセス制御方法、および車両アクセス制御プログラム
JP2016152438A (ja) ソフトウェア更新装置、携帯端末及びソフトウェア更新システム
CN112347481A (zh) 安全启动方法、控制器和控制系统
CN111344996A (zh) 密钥生成方法、获取方法、私钥更新方法、芯片和服务器
JP7067508B2 (ja) ネットワークシステム
JP6461272B1 (ja) 制御装置
JP2020088458A (ja) 情報処理装置
US10785034B2 (en) Implementation unit, implementation unit verification method, and computer-readable recording medium
EP3200388A1 (en) User permission check system
JP7105894B2 (ja) 相互認証方法及び通信システム
JP6919430B2 (ja) ネットワークシステム
KR101438010B1 (ko) 저전력 마이크로프로세서를 이용한 난수 발생 방법 및 이를 위한 장치
EP4325766A1 (en) Data transmission method and communication apparatus
JP2015015536A (ja) セキュリティ装置、セキュリティ装置を含む認証システム、認証プログラムおよび認証方法

Legal Events

Date Code Title Description
AS Assignment

Owner name: DENSO TEN LIMITED, JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:YOHATA, HIRONORI;UMEYAMA, SHIGETO;MORI, NAOTO;REEL/FRAME:052065/0029

Effective date: 20200217

FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED

STCF Information on status: patent grant

Free format text: PATENTED CASE